Simply Schedule Appointments <= 1.6.13.0 - Unauthenticated Sensitive Information Exposure via Booking App Appointment Types
- ID
- WPSEC-2026-2886
- Plugin
- Simply Schedule Appointments (simply-schedule-appointments)
- Affected
- all versions before 1.6.13.4
- Remediation
- Update to 1.6.13.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-12
- Attack surface
- Simply Schedule Appointments on WPSec AttackSurface
- Fix released
- Published
Description
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure via the public booking app page (ssa_embed) in all versions up to, and including, 1.6.13.0, due to the page printing raw appointment type records into its inline JSON, including unpublished appointment types and the connected Google Calendar identifiers, the booking calendar account and the web meeting settings that the appointment types REST listing withholds from visitors. This makes it possible for unauthenticated attackers to view appointment type configuration and connected account details that should not be publicly exposed.
References
- https://wpsec.com/vuln/WPSEC-2026-2886/
- https://plugins.svn.wordpress.org/simply-schedule-appointments/tags/1.6.13.4/
- https://wordpress.org/plugins/simply-schedule-appointments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS